Privacy Policy

1. Who is responsible for your data?

The data controller is TYRUN BV, with its registered office at Caudenberg 11, 9570 Lierde, België, registered with the Belgian Crossroads Bank for Enterprises under number BE 0770.444.274.

For any questions about this policy or about the processing of your data, you can reach us at support@tyrun.com.

2. Which personal data do we process?

Depending on how you interact with us, we process:

• Identification and contact details: first name, last name, email address, phone number.
• Event and registration data: the event, timeslot or division you sign up for, your participation status and how you heard about us.
• Order and payment data when you purchase tickets or products (payment itself runs through our payment partner; we never see your full card details).
• Newsletter and communication preferences, including your consent and language.
• Usage data when you visit the website: IP address, device and browser information, pages visited and interactions, collected through cookies and similar technologies (see section 10).

3. Why and on which legal basis do we use your data?

We process your data exclusively for the following purposes:

• Managing your registration and participation in events, including confirmation and practical emails — legal basis: performance of a contract (art. 6.1.b GDPR).
• Processing orders and payments — legal basis: performance of a contract and legal (accounting) obligations (art. 6.1.b and 6.1.c GDPR).
• Sending our newsletter and commercial communication — legal basis: your prior consent (art. 6.1.a GDPR), which you can withdraw at any time via the unsubscribe link.
• Measuring and improving our website and campaigns (statistics, ad measurement) — legal basis: your consent for non-essential cookies and pixels (art. 6.1.a GDPR).
• Securing our website and preventing abuse (including rate limiting and spam detection) — legal basis: our legitimate interest (art. 6.1.f GDPR).

4. Who do we share your data with?

We never sell your personal data. We only share it with service providers (processors) that process it on our behalf and under our instructions, based on a data processing agreement:

With event partners (such as the venue hosting an event) we only share what is strictly necessary for the organisation, for example a participant list for check-in.

• Hosting services for our website and database (Fly.io).
• Email services for transactional emails such as confirmations (Resend).
• Newsletter services for subscribers (Mailchimp / Intuit).
• Ticketing and registration platforms for paid events (Atleta).
• Advertising and measurement platforms where you have consented (Meta).

5. Is your data processed outside the EEA?

Some of our service providers are established in the United States or process data outside the European Economic Area. In that case we ensure appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and/or certification under the EU-U.S. Data Privacy Framework.

6. How long do we keep your data?

We do not keep your data longer than necessary for the purpose for which it was collected:

• Event registrations: up to 12 months after the event, unless you also consented to further communication.
• Newsletter data: until you unsubscribe or withdraw your consent.
• Invoicing and payment data: 7 years, in accordance with Belgian accounting law.
• Usage data and log files: up to 12 months.

7. How do we protect your data?

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, including encrypted connections (TLS), access management and minimising the data we collect.

8. What are your rights?

Under the GDPR you have the following rights:

• Right of access to the personal data we process about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing based on legitimate interest and to direct marketing.
• Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

9. Complaints

To exercise your rights, email us at support@tyrun.com. We respond within one month at the latest and may ask you to confirm your identity.

If you are not satisfied with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority: Rue de la Presse 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be.

10. Cookies and similar technologies

On your first visit a cookie banner asks for your choice. You can change it at any time via the "Cookie settings" link at the bottom of every page; we keep your choice for at most six months. You can also manage or delete cookies at any time via your browser settings; withdrawn consent applies from that moment onwards. We distinguish three categories:

• Necessary (always active): cookies the site and the ticket checkout need (including your language, the Atleta ticket module and your cookie preference), plus the measurement of our own campaigns: we record which campaign brought you to the site and link it to a purchase, using a device identifier (Fingerprint Pro, processed in the EU) and the Meta pixel — legal basis: our legitimate interest in measuring our advertising spend (art. 6.1.f GDPR).
• Analytics (only with consent): Google Analytics, for statistics on how the site is used.
• Marketing (only with consent): advertising cookies from Google Ads and Reddit, and campaign measurement via CNTRC. Without consent Google only receives cookieless signals (Consent Mode).

11. Changes to this policy

We may update this privacy policy, for example when we launch new services or when regulations change. The most recent version is always available on this page; the date of the last update is shown at the top. For substantial changes we will actively inform you where appropriate.